Add workflow to sync actions/ from github/gh-aw into this repo

[Copilot]

This repo maintains a lightweight copy of the actions developed in github/gh-aw. This adds the automation to keep it in sync.

Workflow: .github/workflows/sync-actions.yml

Triggers

• repository_dispatch (type: sync-actions) — for programmatic invocation from gh-aw CI
• workflow_dispatch with optional ref input (default: latest)

Runtime guards

• Fails early if the repository is a fork
• Fails early if the triggering actor lacks admin or maintain role (checked via GitHub API)

Ref resolution

• latest → resolves to the most recent github/gh-aw release tag; falls back to main HEAD SHA if no releases exist
• Any other value is used as-is

Sync strategy

• Sparse-checks out only actions/ from github/gh-aw at the resolved ref
• Copies into this repo via rsync --archive --delete — remote wins: files absent from the source are deleted locally
• Commits and pushes to main only when there are actual changes

Tagging

• When ref is neither a full 40-char SHA nor latest, creates (or force-updates) a tag = ref on the new commit — keeps version tags in this repo aligned with gh-aw releases

Logging

• Every step uses ::group:: blocks; before/after directory listings and full rsync output are captured for easy debugging

Original prompt

Add a GitHub action (.yml) that runs on repository_dispatch or workflow_dispatch, receives a ref as optional input (default is latest) and commits the file from github/gh-aw/actions from the into the repo. Remote wins for merge conflicts.

The goal is to maintain a copy of the actions developed in github/gh-aw to create a lightweight install experience.

• push to main
• add runtime check that actor is admin or maintainer
• add runtime check to disable forks
• add extensive logging
• if the ref is not a long sha / latest, create tag = ref as well

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to keep this repository’s actions/ directory in sync with github/gh-aw/actions via manual (workflow_dispatch) or programmatic (repository_dispatch) triggers, including logging, permission/fork guards, and optional tagging.

Changes:

• Introduces .github/workflows/sync-actions.yml to resolve a source ref (including latest) and sparse-check out github/gh-aw/actions.
• Syncs the actions/ directory into this repo using rsync --archive --delete, then commits/pushes to main only when changes exist.
• Optionally creates/updates a tag matching the provided ref when it isn’t latest or a full 40-char SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

RAW_REF comes from workflow_dispatch / repository_dispatch input and is written to $GITHUB_OUTPUT using plain echo "key=$value". If RAW_REF contains newlines, it can break the output file format and inject/override step outputs. Use the multiline $GITHUB_OUTPUT format (or otherwise sanitize/validate the ref) before writing outputs.

Suggested change

	echo "resolved_ref=$RESOLVED_REF" >> "$GITHUB_OUTPUT"
	echo "raw_ref=$RAW_REF" >> "$GITHUB_OUTPUT"
	echo "should_create_tag=$SHOULD_CREATE_TAG" >> "$GITHUB_OUTPUT"
	DELIM="EOF_$(date +%s)_$RANDOM"
	{
	echo "resolved_ref<<$DELIM"
	echo "$RESOLVED_REF"
	echo "$DELIM"
	echo "raw_ref<<$DELIM"
	echo "$RAW_REF"
	echo "$DELIM"
	echo "should_create_tag=$SHOULD_CREATE_TAG"
	} >> "$GITHUB_OUTPUT"

[Copilot]

The tag name is derived from user-controlled raw_ref. Git commands here should defensively disambiguate options/refspecs and push an explicit tag ref. As written, git push origin "$TAG" can be ambiguous (e.g., TAG=main may push the branch) and a tag starting with - could be parsed as an option unless -- is used.

Suggested change

	git push origin "$TAG"
	git push origin -- "refs/tags/$TAG"

[pelikhan]

@copilot

• add validation that ref input is either a semver version vMAJOR.MINOR.MPATCH or a long sha or "latest"
• if the ref is a semver, update vMAJOR and vMAJOR.MINOR tags as well